The Kill Chain concept in cybersecurity

Recognition

In this first phase, the attacker will try to collect as much information as possible about his target.

If technical information will be collected thanks to tools (domain names, IP addresses, etc.), the attacker will also use OpenSource Intelligence (OSINT), to collect publicly available information, for example on social networks or news sites (e-mail addresses, names and functions of employees).

Weaponization

Once the attacker is well informed about his victim, he will be able to put together a suitable arsenal to carry out his plan.

He will have the possibility to choose among existing tools (for example non-malicious tools but which will then be diverted from their initial function), to buy malicious software, or to design his own tools.

Delivery

After the well-prepared arsenal, the attacker will have to find a way to transfer all or part of his weaponry to his victim (payload in English).

To do this, the attacker has several solutions, among the most well-known:

• phishing e-mail.
• compromise of a supplier (supply chain).
• social engineering, for example, dropping a booby-trapped USB key in the company's parking lot (social engineering).

Operation

In this phase, the attacker's payload is executed, and will exploit a vulnerability to gain initial access (foothold) on the target's information system.

Installation

After gaining initial access, the attacker must now work to gain sustained access to the information system.

This means that if he loses the connection (in the event of a system reboot, for example), he should not have to repeat the previous phases to regain his access.

There are several techniques for maintaining access to the target:

• Backdoor.
• Scheduled task.
• Web shell for web servers.
• Add a malicious service.

Command & Control (Remote control)

The attacker will now seek to be able to work efficiently, sometimes with limited initial access.

He will therefore use a command and control tool (abbreviated C2 or C&C), which allows him to perform all his operations remotely, from an interface prepared for his attack.

Among the best known Command and Control tools:

• Cobalt Strike
• Empire
• Nighthawk

Actions on Objectives (Final Goal)

The last step for the attacker is of course to achieve his objectives. Having now access to the victim's information system, he will be able to achieve his goal, either indirectly :

• Lateralization (lateral movement)
• Internal recognition
• Privilege escalation

Either directly:

• Espionage
• Ransom